ML-DSA-65 is part of Talero's validator, BFT, checkpoint, P2P and native transaction architecture from the first block.
Public-safe is not unrestricted. Privacy, safe-mode, read-only, quota, role and gateway policies can still mask or deny a listed surface.
Talero produces attestations whose verification remains valid after the quantum transition.
The chain does not depend on a future migration to introduce ML-DSA-65 into its validator identity, BFT evidence, checkpoints, P2P authentication or native transaction format. Each claim maps to a concrete component.
| Component | Cryptography | What it delivers |
|---|---|---|
| Validator identity and registration proof of possession | ML-DSA-65 | Post-quantum validator authorization |
| HotStuff proposals, votes and quorum certificates | ML-DSA-65 | Post-quantum BFT attestations |
| Slashing proofs and finality certificates | ML-DSA-65 | Post-quantum evidence formats |
| Checkpoint notary | ML-DSA-65 | Post-quantum checkpoint attestations outside consensus |
| P2P transport | Hybrid X25519 + ML-KEM-768 key exchange, ML-DSA-65 authentication and ChaCha20-Poly1305 after key exchange | Authenticated and encrypted node transport |
| EVM verification precompile | ML-DSA-65 at 0x0000000000000000000000000000000000000903 | Experimental prototype verifier |
| Native transaction type 0x06 | ML-DSA-65 | Post-quantum signature, active from the first block |
| PoW TaleroHash | Keccak-256 plus memory | Quantum-resistant work function |
| Classic Ethereum transactions | ECDSA secp256k1 | Ethereum compatibility; classical signature |
Under classic_allowed, classic ECDSA transactions and native 0x06 ML-DSA-65 transactions use two address families and one WorldState. The classic route brings MetaMask, ethers and viem; the native route makes the transaction signature itself post-quantum.
PoQ certification is advisory, non-consensus and non-blocking. It provides independently verifiable evidence without deciding block validity or replacing the canonical finality read.
